> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/liveid-selfie.md).
# LiveID Selfie
Users provide a live selfie on a camera-enabled device at the Windows login screen. Facial recognition and liveness detection verify the user is physically present. No password is required when LiveID Selfie is configured as the sole authentication method.
### Admin Setup
#### Configure the Authentication Journey
1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
2. Create a new journey or edit an existing one.
3. Under **Authentication Method**, select **LiveID Selfie**.
4. To use LiveID Selfie as the sole authentication factor (passwordless), select **LiveID Selfie only**. To combine with a password, select **Password & LiveID Selfie**.
5. When LiveID Selfie is configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration.
6. Assign the journey to the target user group or machine policy.
7. Save and publish the journey.
#### Auth Type Configuration
You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the `authType`. This also controls PIN prompts based on whether the device is trusted.
| Value | Description |
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `none` | Users are never prompted for a PIN. |
| `pin` | Users are always prompted for a PIN. |
| `auto` | Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie. |
### User Guide
#### Login from the User Tile
1. At the Windows login screen, click the **1Kosmos tile**.
2. Select **LiveID Selfie** from the available authentication options.
3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.
4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**.
5. After successful authentication, you are logged into the workstation.
{% hint style="info" %}
If you selected **Trust this device**, subsequent logins from this device require only the selfie — no PIN prompt.
{% endhint %}
#### Login from the Other User Tile
1. At the Windows login screen, click **Other User**.
2. Enter your Windows username and press **Enter**.
3. Select **LiveID Selfie** from the available authentication options.
4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.
5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**.
6. After successful authentication, you are logged into the workstation.
***
## LiveID Selfie & Push Notification
Users provide a live selfie on a camera-enabled device and approve the sign-in request via the 1Kosmos mobile app. No password is required when LiveID Selfie & Push Notification is configured as the sole authentication method.
### Admin Setup
#### Configure the Authentication Journey
1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
2. Create a new journey or edit an existing one.
3. Under **Authentication Method**, select **LiveID Selfie & Push Notification**.
4. To use this as the sole authentication factor (passwordless), select **LiveID Selfie & Push Notification only**. To combine with a password, select **Password & LiveID Selfie & Push Notification**.
5. When configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration.
6. Assign the journey to the target user group or machine policy.
7. Save and publish the journey.
#### Auth Type Configuration
You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the `authType`. This also controls PIN prompts based on whether the device is trusted.
| Value | Description |
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `none` | Users are never prompted for a PIN. |
| `pin` | Users are always prompted for a PIN. |
| `auto` | Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie and push approval. |
### User Guide
#### Login from the User Tile
1. At the Windows login screen, click the **1Kosmos tile**.
2. Select **LiveID Selfie** from the available authentication options.
3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.
4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**.
5. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request.
6. After successful authentication, you are logged into the workstation.
{% hint style="info" %}
If you selected **Trust this device**, subsequent logins from this device require only the selfie and push approval no PIN prompt.
{% endhint %}
#### Login from the Other User Tile
1. At the Windows login screen, click **Other User**.
2. Enter your Windows username and press **Enter**.
3. Select **LiveID Selfie** from the available authentication options.
4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.
5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**.
6. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request.
7. After successful authentication, you are logged into the workstation.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/liveid-selfie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.